topic Re: Regex Help in Splunk Search

Regex Help

jacqu3sy — Fri, 16 Mar 2018 10:43:56 GMT

Hi,

I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of whether its in quotes or not. So the values "100", or 'alter user blah identified by *' from the following examples;

ACTION:[3] "100" RETURNCODE:[1]
ACTION :[32] 'alter user scott identified by *' DATABASE

Thanks.

Re: Regex Help

tiagofbmm — Fri, 16 Mar 2018 10:51:51 GMT

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

Re: Regex Help

jacqu3sy — Fri, 16 Mar 2018 11:01:26 GMT

It nearly worked, extracted out the 'alter user scott identified by *' ok, but I didnt get "100" back as a value...

Re: Regex Help

tiagofbmm — Fri, 16 Mar 2018 11:03:01 GMT

Yes, I missed a * in the first \s:

 | rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

Re: Regex Help

jacqu3sy — Fri, 16 Mar 2018 11:14:03 GMT

Awesommmmmmme.

Worked perfectly. Many thanks.